{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T11:01:09Z","timestamp":1777806069408,"version":"3.51.4"},"reference-count":45,"publisher":"SAGE Publications","issue":"6","license":[{"start":{"date-parts":[[2017,12,13]],"date-time":"2017-12-13T00:00:00Z","timestamp":1513123200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2018,10,30]]},"abstract":"<jats:p>CAPTCHAs are reverse Turing tests that aim to distinguish between human and non-human online participants. CAPTCHAs enable site administrators to determine if a particular user is a legitimate human or a bot, and grant or deny them access to resources accordingly, thus preventing abuse of resources. However, given the incentive to break or circumvent CAPTCHAs, they must also evolve alongside advances in machine learning tools and techniques to continue providing security for online services. In this paper, we present the essential design criteria for building robust CAPTCHAs and thus provide a general framework for evaluating a specific CAPTCHA design. We then develop several new CAPTCHA exemplars, and analyze them from this perspective to show how design decisions impact different evaluation parameters. We also provide an overview of a new security method that can be applied to any image CAPTCHA and present the results of the evaluation of one of the most promising image based CAPTCHAs with a comprehensive user study.<\/jats:p>","DOI":"10.3233\/jcs-17947","type":"journal-article","created":{"date-parts":[[2017,12,15]],"date-time":"2017-12-15T11:54:00Z","timestamp":1513338840000},"page":"731-760","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":1,"title":["Towards designing robust CAPTCHAs"],"prefix":"10.1177","volume":"26","author":[{"given":"David","family":"Lorenzi","sequence":"first","affiliation":[{"name":"Management Science and Information Systems Department, Rutgers University, USA. E-mails:\u00a0,\u00a0,\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Emre","family":"Uzun","sequence":"additional","affiliation":[{"name":"Management Science and Information Systems Department, Rutgers University, USA. E-mails:\u00a0,\u00a0,\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jaideep","family":"Vaidya","sequence":"additional","affiliation":[{"name":"Management Science and Information Systems Department, Rutgers University, USA. E-mails:\u00a0,\u00a0,\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shamik","family":"Sural","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Indian Institute of Technology, Kharagpur, India. E-mail:\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vijayalakshmi","family":"Atluri","sequence":"additional","affiliation":[{"name":"Management Science and Information Systems Department, Rutgers University, USA. E-mails:\u00a0,\u00a0,\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2017,12,13]]},"reference":[{"key":"ref001","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2011.102"},{"key":"ref002","doi-asserted-by":"publisher","DOI":"10.1109\/ICISA.2011.5772421"},{"key":"ref003","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-21424-0_5"},{"key":"ref004","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04117-4_15"},{"key":"ref005","doi-asserted-by":"publisher","DOI":"10.1145\/2517312.2517319"},{"key":"ref006","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046724"},{"key":"ref007","doi-asserted-by":"publisher","DOI":"10.1145\/1054972.1055070"},{"key":"ref008","doi-asserted-by":"publisher","DOI":"10.1145\/2598394.2598413"},{"key":"ref009","doi-asserted-by":"publisher","DOI":"10.1145\/2713579.2713592"},{"key":"ref010","doi-asserted-by":"publisher","DOI":"10.1145\/1456377.1456379"},{"key":"ref011","doi-asserted-by":"publisher","DOI":"10.1145\/1101149.1101218"},{"key":"ref012","doi-asserted-by":"publisher","DOI":"10.1145\/1774088.1774483"},{"key":"ref013","doi-asserted-by":"publisher","DOI":"10.1145\/1752046.1752052"},{"key":"ref014","doi-asserted-by":"publisher","DOI":"10.1145\/2557547.2557554"},{"key":"ref015","doi-asserted-by":"publisher","DOI":"10.1145\/2567948.2577305"},{"key":"ref016","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455838"},{"key":"ref017","unstructured":"I.J.\u00a0Goodfellow, Y.\u00a0Bulatov, J.\u00a0Ibarz, S.\u00a0Arnoud and V.D.\u00a0Shet, Multi-digit Number Recognition from Street View Imagery using Deep Convolutional Neural Networks, arXiv:1312.6082, 2013."},{"key":"ref018","doi-asserted-by":"publisher","DOI":"10.1145\/1526709.1526822"},{"key":"ref019","doi-asserted-by":"publisher","DOI":"10.1145\/2381896.2381898"},{"key":"ref020","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-385510-7.00003-5"},{"key":"ref021","unstructured":"F.\u00a0Inc., FunCaptcha: most secure CAPTCHA that\u2019s easy for humans @ONLINE."},{"key":"ref022","unstructured":"M.\u00a0Inc., How-Old.net@ONLINE, 2015."},{"key":"ref023","unstructured":"N.\u00a0Inc., NuCAPTCHA\u00a0\u2013 Adaptive Captcha Authentication @ONLINE."},{"key":"ref024","doi-asserted-by":"publisher","DOI":"10.1145\/1180639.1180841"},{"key":"ref025","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920288"},{"key":"ref026","unstructured":"A.\u00a0Linn, Happy? Sad? Angry? This Microsoft tool recognizes emotions in pictures@ONLINE, 2015."},{"key":"ref027","unstructured":"C.T.\u00a0Lopez, Army\u2019s MIND Lab able to decode brain waves@ONLINE, 2015."},{"key":"ref028","doi-asserted-by":"publisher","DOI":"10.1145\/2752952.2753065"},{"key":"ref029","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-18467-8_24"},{"key":"ref030","unstructured":"J.\u00a0Markoff, Computer Eyesight Gets a Lot More Accurate @ONLINE, 2014."},{"key":"ref031","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590298"},{"key":"ref032","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1157"},{"key":"ref033","unstructured":"M.\u00a0Motoyama, K.\u00a0Levchenko, C.\u00a0Kanich, D.\u00a0McCoy, G.M.\u00a0Voelker and S.\u00a0Savage, Re: CAPTCHAs: Understanding CAPTCHA-solving services in an economic context, in: Proceedings of the 19th USENIX Conference on Security, USENIX Security\u201910, USENIX Association, Berkeley, CA, USA, 2010, pp.\u00a028. ISBN 888-7-6666-5555-4. http:\/\/dl.acm.org\/citation.cfm?id=1929820.1929858."},{"key":"ref034","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2718479"},{"key":"ref035","unstructured":"J.\u00a0Pita, R.\u00a0John, R.\u00a0Maheswaran, M.\u00a0Tambe, R.\u00a0Yang and S.\u00a0Kraus, A robust approach to addressing human adversaries in security games, in: Proceedings of the 11th International Conference on Autonomous Agents and Multiagent Systems\u00a0\u2013 Volume 3, AAMAS\u201912, International Foundation for Autonomous Agents and Multiagent Systems, Richland, SC, 2012, pp.\u00a01297\u20131298. ISBN 0-9817381-3-3, 978-0-9817381-3-0."},{"issue":"1","key":"ref036","first-page":"1","volume":"12","author":"Roshanbin N.","year":"2013","journal-title":"J. Web Eng."},{"key":"ref037","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772774"},{"key":"ref038","doi-asserted-by":"publisher","DOI":"10.1145\/2647868.2655017"},{"key":"ref039","unstructured":"V.\u00a0Shet, Street View and reCAPTCHA technology just got smarter @ONLINE, 2014."},{"key":"ref040","unstructured":"J.P.\u00a0Suphannee\u00a0Sivakorn and A.D.\u00a0Keromytis, I\u2019m not a human: Breaking the Google reCAPTCHA,\n                      BlackHat Asia 2016\n                      ."},{"key":"ref041","doi-asserted-by":"publisher","DOI":"10.1145\/966389.966390"},{"key":"ref042","unstructured":"O.\u00a0Warner, KittenAuth CAPTCHA@ONLINE, 2015."},{"key":"ref043","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2009.84"},{"key":"ref044","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455839"},{"key":"ref045","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866329"}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-17947","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-17947","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-17947","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:45:15Z","timestamp":1777495515000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JCS-17947"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,12,13]]},"references-count":45,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2018,10,30]]}},"alternative-id":["10.3233\/JCS-17947"],"URL":"https:\/\/doi.org\/10.3233\/jcs-17947","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,12,13]]}}}